Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

Splunk released security updates on March 18, 2026, to address a critical vulnerability in Splunk Enterprise, identified as CVE-2026-20253. This flaw allows unauthenticated attackers to perform arbitrary file operations and potentially execute remote code. The vulnerability has a severity rating of 9.8 on the CVSS scoring system, indicating a critical risk. The affected versions of Splunk Enterprise are those below 10.2.4 and 10.0.7. The vulnerability specifically enables an unauthenticated user to create or truncate arbitrary files. Splunk has urged users to update their systems to the patched versions to mitigate the risk of exploitation. The company has not disclosed specific details about any active exploitation of this vulnerability in the wild, but the high CVSS score suggests it is a prime target for malicious actors. This critical flaw underscores the ongoing importance of timely security patching for enterprise software to prevent unauthorized access and data breaches.